CVE-2023-23926: XML External Entity (XXE) vulnerability in apoc.import.graphml
Summary
CVE-2023-23926: XML External Entity (XXE) vulnerability in apoc.import.graphml. Affects org.neo4j.procedure:apoc-core across 2 version ranges.
< 4.4.0.14
>= 5.0.0, < 5.5.0
Fixed in 4.4.0.14 or 5.5.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package under scrutiny is org.neo4j.procedure:apoc-core, which is a core plugin in the Neo4j graph database. It provides additional procedures and functions for data import and manipulation. The apoc.import.graphml procedure allows importing data from GraphML files into the Neo4j database. However, this procedure is vulnerable to XML External Entity (XXE) injection.
Vulnerability Detail
The XML External Entity (XXE) vulnerability in the apoc.import.graphml procedure of the APOC core plugin allows for the injection of external entities. This vulnerability arises when the XML parser used by the procedure allows the resolution of external entities. As a result, attackers can exploit this vulnerability to read local files remotely, send HTTP requests, and perform denial-of-service attacks. The impact of this vulnerability is limited to one-line files for assessors with restricted privileges, but with the ability to write to the database, any file could be read. Additionally, passing improperly formatted XML can crash the server.
How To Fix
Latest published version: 2026.10.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.4.0.144.4.0.14 -
>= 5.0.0, < 5.5.05.5.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading the library is not possible, users can control the allowlist of procedures that can be used in their system. This can be done by configuring the allowlist in the Neo4j configuration file (config_dbms.security.procedures.allowlist). By limiting the procedures that can be executed, the risk of exploitation can be mitigated.
Conclusion
The XML External Entity (XXE) vulnerability in the apoc.import.graphml procedure of the APOC core plugin in Neo4j graph database allows for remote reading of local files and potential denial-of-service attacks. It is recommended to upgrade to the latest patched version of the org.neo4j.procedure:apoc-core package. If upgrading is not possible, controlling the allowlist of procedures can help mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.neo4j.procedure:apoc-core →
FAQ
The vulnerability allows attackers to read local files remotely, send HTTP requests, and perform denial-of-service attacks on the application. However, the impact is limited to one-line files for assessors with restricted privileges.
Yes, passing improperly formatted XML can crash the server.
To fix this vulnerability, upgrade to the latest released version of the org.neo4j.procedure:apoc-core package that is compatible with your Neo4j version.
If upgrading the library is not possible, you can control the allowlist of procedures that can be used in your system. Configure the allowlist in the Neo4j configuration file (config_dbms.security.procedures.allowlist) to limit the procedures that can be executed.
This vulnerability was discovered by Christopher Schneider from State Farm.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
